Extracted

• • Target

    a3eae74b92cfd53b18988ab350dba06e3643abcc0ea910dd6559456caecc8b35

  • Size

    4.5MB

  • MD5

    a8e5097d47e2f1652a9523e031c6f510

  • SHA1

    4b6147f0f56281f0775f68e7a4bb8f68fa100689

  • SHA256

    a3eae74b92cfd53b18988ab350dba06e3643abcc0ea910dd6559456caecc8b35

  • SHA512

    a474dbb1b3c2f14b7fbbe0e9a59dca9b6af8e965b887b3b94586220904c0fd1a8e9a24f89d9127d815620408b6b45bcb649a72ab9b905ef36d27d2b419340b21

  • SSDEEP

    98304:oxOlsWWdEhop1fqO0hqGriAtBLTF1OJkmWwW6hGYE12kO:oxOlsWWOQ1fqkGrX1TCibb67j

  Score

  10^/10

  amadeyxmrigevasionminerspywarestealertrojanupx

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Modifies security service

    evasion

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig

  • XMRig Miner payload

    miner

  • Stops running service(s)

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Legitimate hosting services abused for malware hosting/C2

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1